Because that's quite unrelated. Websites display will be fine or break independently of the OS, but depending how the browser has been updated to follow the last trend or not. Same goes for security: if he doesn't install crap on his XP, the main source of danger is Internet: malicious files input to unmaintained programs, and of course his Web browser first. Maybe there are performance improvement coming too, either in the browser or the e-mail client.

Personally, I don't use XP, but I'm stuck with 2.49.1 because they broke GTK2 support between that version and 2.49.5. When I'll have enough, I'll switch to another browser, perhaps Palemoon which still had GTK2 support last time I built it (28.6.1). /Edit:/ Just checked on Palemoon forum: they say they will support GTK2 until at least 2024.